hfsplus: fix overflow in hfsplus_get_block
[deliverable/linux.git] / fs / hfsplus / wrapper.c
CommitLineData
1da177e4
LT
1/*
2 * linux/fs/hfsplus/wrapper.c
3 *
4 * Copyright (C) 2001
5 * Brad Boyer (flar@allandria.com)
6 * (C) 2003 Ardis Technologies <roman@ardistech.com>
7 *
8 * Handling of HFS wrappers around HFS+ volumes
9 */
10
11#include <linux/fs.h>
12#include <linux/blkdev.h>
13#include <linux/cdrom.h>
14#include <linux/genhd.h>
1da177e4
LT
15#include <asm/unaligned.h>
16
17#include "hfsplus_fs.h"
18#include "hfsplus_raw.h"
19
20struct hfsplus_wd {
21 u32 ablk_size;
22 u16 ablk_start;
23 u16 embed_start;
24 u16 embed_count;
25};
26
52399b17
CH
27static void hfsplus_end_io_sync(struct bio *bio, int err)
28{
29 if (err)
30 clear_bit(BIO_UPTODATE, &bio->bi_flags);
31 complete(bio->bi_private);
32}
33
34int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
35 void *data, int rw)
36{
37 DECLARE_COMPLETION_ONSTACK(wait);
38 struct bio *bio;
50176dde 39 int ret = 0;
52399b17
CH
40
41 bio = bio_alloc(GFP_NOIO, 1);
42 bio->bi_sector = sector;
43 bio->bi_bdev = bdev;
44 bio->bi_end_io = hfsplus_end_io_sync;
45 bio->bi_private = &wait;
46
47 /*
48 * We always submit one sector at a time, so bio_add_page must not fail.
49 */
50 if (bio_add_page(bio, virt_to_page(data), HFSPLUS_SECTOR_SIZE,
51 offset_in_page(data)) != HFSPLUS_SECTOR_SIZE)
52 BUG();
53
54 submit_bio(rw, bio);
55 wait_for_completion(&wait);
56
57 if (!bio_flagged(bio, BIO_UPTODATE))
50176dde
SF
58 ret = -EIO;
59
60 bio_put(bio);
61 return ret;
52399b17
CH
62}
63
1da177e4
LT
64static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
65{
66 u32 extent;
67 u16 attrib;
2179d372 68 __be16 sig;
1da177e4 69
2179d372
DE
70 sig = *(__be16 *)(bufptr + HFSP_WRAPOFF_EMBEDSIG);
71 if (sig != cpu_to_be16(HFSPLUS_VOLHEAD_SIG) &&
72 sig != cpu_to_be16(HFSPLUS_VOLHEAD_SIGX))
1da177e4
LT
73 return 0;
74
75 attrib = be16_to_cpu(*(__be16 *)(bufptr + HFSP_WRAPOFF_ATTRIB));
76 if (!(attrib & HFSP_WRAP_ATTRIB_SLOCK) ||
77 !(attrib & HFSP_WRAP_ATTRIB_SPARED))
78 return 0;
79
2753cc28
AS
80 wd->ablk_size =
81 be32_to_cpu(*(__be32 *)(bufptr + HFSP_WRAPOFF_ABLKSIZE));
1da177e4
LT
82 if (wd->ablk_size < HFSPLUS_SECTOR_SIZE)
83 return 0;
84 if (wd->ablk_size % HFSPLUS_SECTOR_SIZE)
85 return 0;
2753cc28
AS
86 wd->ablk_start =
87 be16_to_cpu(*(__be16 *)(bufptr + HFSP_WRAPOFF_ABLKSTART));
1da177e4 88
8b3789e5 89 extent = get_unaligned_be32(bufptr + HFSP_WRAPOFF_EMBEDEXT);
1da177e4
LT
90 wd->embed_start = (extent >> 16) & 0xFFFF;
91 wd->embed_count = extent & 0xFFFF;
92
93 return 1;
94}
95
96static int hfsplus_get_last_session(struct super_block *sb,
97 sector_t *start, sector_t *size)
98{
99 struct cdrom_multisession ms_info;
100 struct cdrom_tocentry te;
101 int res;
102
103 /* default values */
104 *start = 0;
105 *size = sb->s_bdev->bd_inode->i_size >> 9;
106
dd73a01a
CH
107 if (HFSPLUS_SB(sb)->session >= 0) {
108 te.cdte_track = HFSPLUS_SB(sb)->session;
1da177e4 109 te.cdte_format = CDROM_LBA;
2753cc28
AS
110 res = ioctl_by_bdev(sb->s_bdev,
111 CDROMREADTOCENTRY, (unsigned long)&te);
1da177e4
LT
112 if (!res && (te.cdte_ctrl & CDROM_DATA_TRACK) == 4) {
113 *start = (sector_t)te.cdte_addr.lba << 2;
114 return 0;
115 }
634725a9 116 printk(KERN_ERR "hfs: invalid session number or type of track\n");
1da177e4
LT
117 return -EINVAL;
118 }
119 ms_info.addr_format = CDROM_LBA;
2753cc28
AS
120 res = ioctl_by_bdev(sb->s_bdev, CDROMMULTISESSION,
121 (unsigned long)&ms_info);
1da177e4
LT
122 if (!res && ms_info.xa_flag)
123 *start = (sector_t)ms_info.addr.lba << 2;
124 return 0;
125}
126
127/* Find the volume header and fill in some minimum bits in superblock */
128/* Takes in super block, returns true if good data read */
129int hfsplus_read_wrapper(struct super_block *sb)
130{
dd73a01a 131 struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
1da177e4
LT
132 struct hfsplus_wd wd;
133 sector_t part_start, part_size;
134 u32 blocksize;
52399b17 135 int error = 0;
1da177e4 136
52399b17 137 error = -EINVAL;
1da177e4
LT
138 blocksize = sb_min_blocksize(sb, HFSPLUS_SECTOR_SIZE);
139 if (!blocksize)
52399b17 140 goto out;
1da177e4
LT
141
142 if (hfsplus_get_last_session(sb, &part_start, &part_size))
52399b17 143 goto out;
5c36fe3d
BH
144 if ((u64)part_start + part_size > 0x100000000ULL) {
145 pr_err("hfs: volumes larger than 2TB are not supported yet\n");
52399b17 146 goto out;
5c36fe3d 147 }
1da177e4 148
52399b17
CH
149 error = -ENOMEM;
150 sbi->s_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
151 if (!sbi->s_vhdr)
152 goto out;
153 sbi->s_backup_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
154 if (!sbi->s_backup_vhdr)
155 goto out_free_vhdr;
156
157reread:
158 error = hfsplus_submit_bio(sb->s_bdev,
159 part_start + HFSPLUS_VOLHEAD_SECTOR,
160 sbi->s_vhdr, READ);
161 if (error)
162 goto out_free_backup_vhdr;
163
164 error = -EINVAL;
165 switch (sbi->s_vhdr->signature) {
166 case cpu_to_be16(HFSPLUS_VOLHEAD_SIGX):
167 set_bit(HFSPLUS_SB_HFSX, &sbi->flags);
168 /*FALLTHRU*/
169 case cpu_to_be16(HFSPLUS_VOLHEAD_SIG):
170 break;
171 case cpu_to_be16(HFSP_WRAP_MAGIC):
172 if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))
a1dbcef0 173 goto out_free_backup_vhdr;
52399b17
CH
174 wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
175 part_start += wd.ablk_start + wd.embed_start * wd.ablk_size;
176 part_size = wd.embed_count * wd.ablk_size;
177 goto reread;
178 default:
179 /*
180 * Check for a partition block.
181 *
1da177e4
LT
182 * (should do this only for cdrom/loop though)
183 */
184 if (hfs_part_find(sb, &part_start, &part_size))
a1dbcef0 185 goto out_free_backup_vhdr;
52399b17
CH
186 goto reread;
187 }
188
189 error = hfsplus_submit_bio(sb->s_bdev,
190 part_start + part_size - 2,
191 sbi->s_backup_vhdr, READ);
192 if (error)
193 goto out_free_backup_vhdr;
194
195 error = -EINVAL;
196 if (sbi->s_backup_vhdr->signature != sbi->s_vhdr->signature) {
197 printk(KERN_WARNING
198 "hfs: invalid secondary volume header\n");
199 goto out_free_backup_vhdr;
1da177e4
LT
200 }
201
52399b17 202 blocksize = be32_to_cpu(sbi->s_vhdr->blocksize);
1da177e4 203
52399b17
CH
204 /*
205 * Block size must be at least as large as a sector and a multiple of 2.
1da177e4 206 */
52399b17
CH
207 if (blocksize < HFSPLUS_SECTOR_SIZE || ((blocksize - 1) & blocksize))
208 goto out_free_backup_vhdr;
dd73a01a
CH
209 sbi->alloc_blksz = blocksize;
210 sbi->alloc_blksz_shift = 0;
1da177e4 211 while ((blocksize >>= 1) != 0)
dd73a01a
CH
212 sbi->alloc_blksz_shift++;
213 blocksize = min(sbi->alloc_blksz, (u32)PAGE_SIZE);
1da177e4 214
52399b17
CH
215 /*
216 * Align block size to block offset.
217 */
1da177e4
LT
218 while (part_start & ((blocksize >> HFSPLUS_SECTOR_SHIFT) - 1))
219 blocksize >>= 1;
220
221 if (sb_set_blocksize(sb, blocksize) != blocksize) {
2753cc28
AS
222 printk(KERN_ERR "hfs: unable to set blocksize to %u!\n",
223 blocksize);
52399b17 224 goto out_free_backup_vhdr;
1da177e4
LT
225 }
226
dd73a01a
CH
227 sbi->blockoffset =
228 part_start >> (sb->s_blocksize_bits - HFSPLUS_SECTOR_SHIFT);
52399b17 229 sbi->part_start = part_start;
dd73a01a
CH
230 sbi->sect_count = part_size;
231 sbi->fs_shift = sbi->alloc_blksz_shift - sb->s_blocksize_bits;
1da177e4 232 return 0;
52399b17
CH
233
234out_free_backup_vhdr:
235 kfree(sbi->s_backup_vhdr);
236out_free_vhdr:
237 kfree(sbi->s_vhdr);
238out:
239 return error;
1da177e4 240}
This page took 0.506637 seconds and 5 git commands to generate.